16,585 results · Clear filters · Feed
-
Medium 4.2
Session Fixation in froxlor/froxlor
Session Fixation in GitHub repository froxlor/froxlor prior to 2.1.0.
-
Medium 4.3
Local File Inclusion vulnerability in Gatsby
Gatsby is a free and open source framework based on React. The Gatsby framework prior to versions 4.25.7 and 5.9.1 contain a Local File Inclusion vulnerability in the `__file-code-frame` and `__original-stack-frame` paths, exposed when running the Gatsby deve…
-
Medium 6.3
rails-ujs vulnerable to DOM Based Cross-site Scripting contenteditable HTML Elements
There is a potential DOM based cross-site scripting issue in rails-ujs which leverages the Clipboard API to target HTML elements that are assigned the contenteditable attribute. This has the potential to occur when pasting malicious HTML content from the clip…
-
Medium 5.3
Kredis JSON Possible Deserialization of Untrusted Data Vulnerability
There is a deserialization of untrusted data vulnerability in the Kredis JSON deserialization code
-
Medium 5.3
Denial of Service
Vapor is a web framework for Swift. In Vapor before version 4.40.1, there is a DoS attack against anyone who Bootstraps a metrics backend for their Vapor app. The following is the attack vector: 1. send unlimited requests against a vapor instance with differe…
-
Medium 4.3
Vault’s KV Diff Viewer Allowed for HTML Injection
Vault and Vault Enterprise's (Vault) key-value v2 (kv-v2) diff viewer allowed HTML injection into the Vault web UI through key values. This vulnerability, CVE-2023-2121, is fixed in Vault 1.14.0, 1.13.3, 1.12.7, and 1.11.11.
-
Medium 6.5
Path Traversal in froxlor/froxlor
Path Traversal in GitHub repository froxlor/froxlor prior to 2.0.20.
-
Medium 5.3
Governor proposal creation may be blocked by frontrunning in OpenZeppelin
OpenZeppelin Contracts is a library for smart contract development. By frontrunning the creation of a proposal, an attacker can become the proposer and gain the ability to cancel it. The attacker can do this repeatedly to try to prevent a proposal from being …
-
Medium 5.4
Default `maxSignatureAttempts` in `notation verify` enables an endless data attack in notation
notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry and added a high number of signatures to an artifact can cause denial of service of services on the machine, if a user runs notation verif…
-
Medium 5.4
Improper checks for deactivated users during login in synapse
Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. In affected versions it may be possible for a deactivated user to login when using uncommon configurations. This only applies if any of the following are true: 1. JSON Web T…
-
Medium 4.6
Cross-site Scripting (XSS) in Web GUI in syncthing
Syncthing is an open source, continuous file synchronization program. In versions prior to 1.23.5 a compromised instance with shared folders could sync malicious files which contain arbitrary HTML and JavaScript in the name. If the owner of another device loo…
-
Medium —
trust-dns vulnerable to Remote Attackers causing Denial-of-Service (packet loops) with crafted DNS packets
trust-dns and trust-dns-server are vulnerable to remotely triggered denial-of-service attacks, consuming both network and CPU resources. DNS messages with the QR=1 bit set are responded to with a `FormErr` response. This allows creating a traffic loop, in whi…
-
Medium 6.3
Path Traversal: '\..\filename' in pimcore/pimcore
Path Traversal: '\..\filename' in GitHub repository pimcore/pimcore prior to 10.5.22.
-
Medium 6.5
Privilege Defined With Unsafe Actions in pimcore/pimcore
Privilege Defined With Unsafe Actions in GitHub repository pimcore/pimcore prior to 10.5.23.
-
Medium 5.4CVE-2023-33962 Public exploit
JStachio XSS vulnerability: Unescaped single quotes
JStachio is a type-safe Java Mustache templating engine. Prior to version 1.0.1, JStachio fails to escape single quotes `'` in HTML, allowing an attacker to inject malicious code. This vulnerability can be exploited by an attacker to execute arbitrary JavaScr…
-
Medium 6.3
Cross-site Scripting (XSS) - Stored in admidio/admidio
Cross-site Scripting (XSS) - Stored in GitHub repository admidio/admidio prior to 4.2.8.
-
Medium 6.5
Kyverno resource with a deletionTimestamp may allow policy circumvention
Kyverno is a policy engine designed for Kubernetes. In versions of Kyverno prior to 1.10.0, resources which have the `deletionTimestamp` field defined can bypass validate, generate, or mutate-existing policies, even in cases where the `validationFailureAction…
-
Medium 6.1
Gitpod vulnerable to Cross-site Scripting
Gitpod before 2022.11.3 allows XSS because redirection can occur for some protocols outside of the trusted set of three (vscode: vscode-insiders: jetbrains-gateway:).
-
Medium 6.2
Improper Access Control in nilsteampassnet/teampass
Improper Access Control in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
-
Medium 6.1
Cross-site Scripting (XSS) - Stored in nilsteampassnet/teampass
Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
-
Medium 4.9
Consul Cluster Peering can Result in Denial of Service
Consul and Consul Enterprise's cluster peering implementation contained a flaw whereby a peer cluster with service of the same name as a local service could corrupt Consul state, resulting in denial of service. This vulnerability was resolved in Consul 1.14.5…
-
Medium 4.3
PocketMine-MP before 4.18.0-ALPHA2 Bandwidth Amplification via InventoryTransactionPacket
PocketMine-MP before 4.18.0-ALPHA2 fails to rate-limit mismatch type InventoryTransactionPacket requests, allowing attackers to trigger excessive inventory synchronization. Attackers can send numerous mismatch transactions to force the server to transmit larg…
-
Medium 5.5
hawtio vulnerable to Path Traversal
hawtio 2.17.2 is vulnerable to Path Traversal. it is possible to input malicious zip files, which can result in the high-risk files after decompression being stored in any location, even leading to file overwrite.
-
Medium 5.5
janino vulnerable to denial of service due to stack overflow
Janino 3.1.9 and earlier are subject to denial of service (DOS) attacks when using the expression evaluator.guess parameter name method. If the parser runs on user-supplied input, an attacker could supply content that causes the parser to crash due to a stack…
-
Medium 6.3
Parse Server vulnerable to phishing attack vulnerability that involves uploading malicious HTML file
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Versions prior to 5.4.4 and 6.1.1 are vulnerable to a phishing attack vulnerability that involves a user uploading malicious files. A malicious user could …
-
Medium 5.4
Dcat-Admin vulnerable to Stored Cross-site Scripting
A stored cross-site scripting (XSS) vulnerability in Dcat-Admin v2.1.3-beta allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the URL parameter.
-
Medium 5.4
Algernon engine and themes vulnerable to Cross-site Scripting
All versions of the package github.com/xyproto/algernon/engine; all versions of the package github.com/xyproto/algernon/themes are vulnerable to Cross-site Scripting (XSS) via the themes.NoPage(filename, theme) function due to improper user input sanitization…
-
Medium 6.0
Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.14.
-
Medium 6.7
Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.14.
-
Medium 6.3
Abstrium Pydio Cells User Creation resource injection
A vulnerability classified as critical was found in Abstrium Pydio Cells 4.2.0. This vulnerability affects unknown code of the component User Creation Handler. The manipulation leads to improper control of resource identifiers. The attack can be initiated rem…
-
Medium 4.6
Abstrium Pydio Cells Change Subscription authorization
A vulnerability was found in Abstrium Pydio Cells 4.2.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Change Subscription Handler. The manipulation leads to authorization bypass. The exploit has been …
-
Medium 5.4
Prototype Pollution in antfu/utils
Prototype Pollution in GitHub repository antfu/utils prior to 0.7.3.
-
Medium 5.3
malformed proposed intoto v0.0.2 entries can cause a panic in Rekor
Rekor's goals are to provide an immutable tamper resistant ledger of metadata generated within a software projects supply chain. A malformed proposed entry of the `intoto/v0.0.2` type can cause a panic on a thread within the Rekor process. The thread is recov…
-
Medium 5.4
Stored cross site scripting in Craft CMS
A post-authentication stored cross-site scripting vulnerability exists in Craft CMS versions <= 4.4.11. HTML, including script tags can be injected into field names which, when the field is added to a category or section, will trigger when users visit the Cat…
-
Medium 6.5
Kubernetes secrets-store-csi-driver discloses service account tokens in logs
Kubernetes secrets-store-csi-driver in versions before 1.3.3 discloses service account tokens in logs.
-
Medium 4.3
Minio console object names with RIGHT-TO-LEFT OVERRIDE unicode character can be exploited
Minio Console is the UI for MinIO Object Storage. Unicode RIGHT-TO-LEFT OVERRIDE characters can be used to mask the original filename. This issue has been patched in version 0.28.0.
-
Medium 5.5
Craft CMS stored XSS in indexedVolumes
Craft is a CMS for creating custom digital experiences on the web. Cross-site scripting (XSS) can be triggered via the Update Asset Index utility. This issue has been patched in version 4.4.6.
-
Medium 5.5
Craft CMS stored XSS in review volume
Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered by review volumes. This issue has been fixed in version 4.4.7.
-
Medium 5.0
Craft CMS XSS in RSS widget feed
Craft is a CMS for creating custom digital experiences on the web. A malformed RSS feed can deliver an XSS payload. This issue was patched in version 4.4.6.
-
Medium 5.4
highlight vulnerable to cleartext transmission of sensitive information
Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when a password html input is switched to `type="text"` via a javascript "Show Password" button. This differs from the expected behavior which …